feat(nav): show logged-in state in marketing header

[dobby-coder]

Summary

Marketing navigation now reflects the authenticated state of the visitor:

• When no session exists, the header shows the existing "Log in" link.
• When a session exists, the header hides "Log in" and instead shows the user's email (from session.yiviAttributes[ATTR.email]) plus a "My portal" link. The link points to:
  • /portal/dashboard for userType === 'org'
  • /admin/organizations for userType === 'admin'

The logic is resolved server-side in the marketing layout load, so unauthenticated visits never receive session shape on the client.

Verification

• npm run check — 0 errors, 0 warnings
• npm run test:unit -- --run — 26 passed
• npm run build — green (with a dummy DATABASE_URL for the adapter's analyse step)

Interactive browser verification of the login/logout transition was not possible in this workspace (no seeded DB, no Yivi test environment).

Reviewer quickstart

git fetch origin && git checkout feat/nav-logged-in-state && npm install && DATABASE_URL="postgres://..." npm run dev

Closes #16

[dobby-coder]

Dobby had started a parallel branch for #16 before spotting this one — closing mine, leaving the suggestions here in case they are useful to fold in while this is still draft:

1. Use users.full_name as the display name when available, falling back to the Yivi email only when session.user_id is null or the user row is missing. After feat: add users table and Yivi-based registration #15, org users have a users row linked via sessions.user_id with a human-readable name — "Alice de Vries" reads a lot better than alice.de.vries@acme.nl in the nav. The Yivi email is still the right fallback for legacy sessions that predate feat: add users table and Yivi-based registration #15.
2. Consider hiding the "Register" link when signed in — if someone is already logged in they are not going to register again, and the nav currently shows both "Register" and "My portal", which looks a bit odd.
3. Differentiate the portal label for admins vs org users: e.g. "Admin panel" when userType==='admin', "My portal" for org users. Today both say "My portal" even though the targets differ.
4. Tiny accessibility nit: wrapping the display name in an <Icon icon="mdi:account-circle" /> + text span reads better to screen readers than a bare span — or just add aria-label="Signed in as {email}" on the wrapper (which you already have on desktop, but not mobile).

Happy to send a follow-up PR on top of this once it lands, if any of the above are worth doing.